Search Results (Refine Search)
- CPE Product Version: cpe:/a:apache:tomcat:7.0.0:beta
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2011-3190 |
Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request. Published: August 31, 2011; 7:55:03 PM -0400 |
V3.x:(not available) V2.0: 7.5 HIGH |
CVE-2011-2729 |
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application. Published: August 15, 2011; 5:55:02 PM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2011-2481 |
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression. Published: August 15, 2011; 5:55:01 PM -0400 |
V3.x:(not available) V2.0: 4.6 MEDIUM |
CVE-2011-2526 |
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application. Published: July 14, 2011; 7:55:06 PM -0400 |
V3.x:(not available) V2.0: 4.4 MEDIUM |
CVE-2011-2204 |
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. Published: June 29, 2011; 1:55:04 PM -0400 |
V3.x:(not available) V2.0: 1.9 LOW |
CVE-2011-1475 |
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users." Published: April 08, 2011; 11:17:28 AM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2011-1419 |
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088. Published: March 14, 2011; 3:55:02 PM -0400 |
V3.x:(not available) V2.0: 5.8 MEDIUM |
CVE-2011-1088 |
Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. Published: March 14, 2011; 3:55:02 PM -0400 |
V3.x:(not available) V2.0: 5.8 MEDIUM |
CVE-2010-4172 |
Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications. Published: November 26, 2010; 3:00:04 PM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2010-2227 |
Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer." Published: July 13, 2010; 1:30:03 PM -0400 |
V3.x:(not available) V2.0: 6.4 MEDIUM |